[email protected]CVE-2013-2279

HistoryMar 21, 2013 - 5:55 p.m.

CVE-2013-2279

2013-03-2117:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2013-2279

ca siteminder

federation

fss

xml signatures

saml

remote attackers

security vulnerability

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

75.2%

JSON

CA SiteMinder Federation (FSS) 12.5, 12.0, and r6; Federation (Standalone) 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain privileges.

CPENameOperatorVersion
siteminder_federation:r6.0siteminder federation r6.0eq*
siteminder_agent_for_sharepoint:2010siteminder agent for sharepoint 2010eq*
siteminder_federation:12.0siteminder federation 12.0eq-
siteminder_federation:12.0siteminder federation 12.0eq*
siteminder_for_secure_proxy_server:6.0siteminder for secure proxy server 6.0eq*
siteminder_federation:12.1siteminder federation 12.1eq-
siteminder_for_secure_proxy_server:12.0siteminder for secure proxy server 12.0eq*
siteminder_for_secure_proxy_server:12.5siteminder for secure proxy server 12.5eq*
siteminder_federation:12.5siteminder federation 12.5eq*

CPE	Name	Operator	Version
siteminder_federation:r6.0	siteminder federation r6.0	eq	*
siteminder_agent_for_sharepoint:2010	siteminder agent for sharepoint 2010	eq	*
siteminder_federation:12.0	siteminder federation 12.0	eq	-
siteminder_federation:12.0	siteminder federation 12.0	eq	*
siteminder_for_secure_proxy_server:6.0	siteminder for secure proxy server 6.0	eq	*
siteminder_federation:12.1	siteminder federation 12.1	eq	-
siteminder_for_secure_proxy_server:12.0	siteminder for secure proxy server 12.0	eq	*
siteminder_for_secure_proxy_server:12.5	siteminder for secure proxy server 12.5	eq	*
siteminder_federation:12.5	siteminder federation 12.5	eq	*

References

archives.neohapsis.com/archives/bugtraq/2013-03/0118.html

secunia.com/advisories/52610

www.securityfocus.com/bid/58609

support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7B53E50CBD-6F6A-4B3A-85FF-36E44ABED8D5%7D

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

75.2%

JSON

Related for CVE-2013-2279

prion1 securityvulns2